The Hidden Costs of Cyber Incidents in Banking

Cyber incidents can impose economic costs on financial institutions that extend well beyond stolen funds or temporary service interruptions. Investigation expenses, system restoration, legal obligations, customer remediation, additional operating costs, and interrupted business activity can affect financial performance across multiple reporting periods.

This research examines the financial consequences of cyber incidents in banking, distinguishing reported direct losses from indirect effects, estimated liabilities, modeled extreme events, and market reactions.

Drawing on evidence from the International Monetary Fund, IBM's Cost of a Data Breach Report, and the Financial Stability Board, the study explores why published cyber incident cost estimates differ and how measurement boundaries affect their interpretation.

The research highlights the risks of double counting, treating delayed transactions as permanent financial losses, and applying industry-wide averages to individual banking incidents without supporting evidence.

Its central finding is that the full economic cost of a banking cyber incident cannot be established by simply adding every financial figure associated with the event.